SonicWall VPN flaw lets attackers skip SAML sign-in and its multi-factor check (CVE-2026-19868)

9 November 2026High 7.5Being exploited

SonicWall · SonicOS SSLVPN · CVE-2026-19868

SonicWall VPN flaw lets attackers skip SAML sign-in and its multi-factor check

A flaw in the SSL VPN service of SonicWall firewalls lets someone who holds valid credentials for another sign-in method get around SAML authentication, including any multi-factor check enforced through SAML. SonicWall says it is being exploited, and CISA added it to its Known Exploited Vulnerabilities catalogue on 6 November. It matters because a VPN that relies on SAML for multi-factor protection may be letting people in without it.

Affected: SonicOS on Gen7 and Gen8 SonicWall firewalls with the SSLVPN service using SAML sign-in. NVD lists 7.3.3-7015 and older, and 8.2.2-8015 and older, as affected; the Canadian Centre for Cyber Security lists versions before 7.3.4-7013 and before 8.2.2-8015. These two lists disagree on the 8.2.x line, so confirm against SonicWall's advisory.
What to do: Read SonicWall advisory SNWLID-2026-0014 and apply the fixes or mitigations it gives. CISA's instruction is to apply the vendor's mitigations (due 20 November for US agencies). Until then, limit who can reach the SSL VPN from the internet, and check VPN logs for sign-ins that did not go through your SAML provider.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Confirmed exploited and in CISA's catalogue, in a firewall and VPN product many small businesses run.

SonicWall VPN flaw lets attackers skip SAML sign-in and its multi-factor check

Affected

SonicOS on Gen7 and Gen8 SonicWall firewalls with the SSLVPN service using SAML sign-in. NVD lists 7.3.3-7015 and older, and 8.2.2-8015 and older, as affected; the Canadian Centre for Cyber Security lists versions before 7.3.4-7013 and before 8.2.2-8015. These two lists disagree on the 8.2.x line, so confirm against SonicWall's advisory.

What to do

Read SonicWall advisory SNWLID-2026-0014 and apply the fixes or mitigations it gives. CISA's instruction is to apply the vendor's mitigations (due 20 November for US agencies). Until then, limit who can reach the SSL VPN from the internet, and check VPN logs for sign-ins that did not go through your SAML provider.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Confirmed exploited and in CISA's catalogue, in a firewall and VPN product many small businesses run.